rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

`smallwebwaf` with no command now prints the commands and exits with status 2.
The image runs rproxy, or servewaf with SMALLWEBWAF_COMMAND=servewaf. The
passing-on code, its settings and its log fields and metric go. internal/proxy
keeps the checks, answers, reports and own endpoints; its tests run through the
real rproxy. The documents describe the pair.

Judgement call: clients.json keeps token_refused, since state files refuse unknown fields.
Deviation: script/gitea-requests sets SWWAF_LOG_REQUEST_HEADERS, to label requests.
Partially verified: make example-app and make gitea-requests never built the image, as Ubuntu's snapshot service answered 5xx.

Model: opus-5-5

Dockerfile

@@ -117,8 +117,9 @@ RUN git checkout --quiet --detach b4b2c785308b1ce785b6155c7fe5f16879080193 \
     && CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" \
         -o /usr/local/bin/runsvinit .
 
-# The image an app's Dockerfile builds FROM, described under "Deployment"
-# in SPEC.md. It is the last stage, so a plain `docker build .` builds it.
+# The image, described under "Deployment" in SPEC.md. It runs rproxy unless
+# SMALLWEBWAF_COMMAND says servewaf, and an app's Dockerfile can build FROM it.
+# It is the last stage, so a plain `docker build .` builds it.
 #
 # ubuntu 26.04, 2026-09-27
 FROM ubuntu@sha256:f144425ff09be612d6d9ad965196e9cdc23dae1f42110a8a11a3e9a8198759f7
@@ -197,11 +198,11 @@ RUN groupadd --system --gid 65532 smallwebwaf \
 
 # The state files' directory, SWWAF_STATE_DIR by default, where a volume
 # is mounted to keep them across deploys. The run script gives it to the
-# smallwebwaf user at each start.
+# smallwebwaf user at each start of servewaf.
 RUN mkdir /var/lib/smallwebwaf
 
-# The default rule file, in SWWAF_RULES_DIR by default, where an app's
-# Dockerfile can copy rule files of its own beside it.
+# The default rule file, in SWWAF_RULES_DIR by default, where a Dockerfile
+# built FROM this image can copy rule files of its own beside it.
 COPY share/rules.d/00-default.rules /etc/smallwebwaf/rules.d/00-default.rules
 
 # runsvinit starts runit's runsvdir on /etc/service, where Ubuntu's sv